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DIRECTOR OF CENTRAL INTELLIGENCE 
Security Committee SECOM-D-015 


11 January 1980 


MEMORANDUM FOR: Chairman, Computer Security Subcommittee 


PROM: 
| eeCuETyS SoCreTaTy STATINTL 


SUBJECT: Proposed Briefing of Your Subcommittee 


Cecil, 


Within the CIA, an Information Task Force has been 
working for sometime to review and recommend Information 
Handling Goals. Attached is a copy of a list of such goals. 


It came to mind that you and members of your Subcommittee 
might have shared interest with this Agency Task Force, might 
have mutually reinforcing goals and may, during discussions, 
identify issues or aspects that could beneficially serve 
the common needs of the Agency and Community. 


If you agree let me know about a time and I'll put you 
in touch with ERAS Chairman, IHTF, who has agreed 
to address the Subcommittee if you are interested. 


a 


Attachment 


oe - Addressee w/att 
- SECOM Chrono w/att 
1 - SECOM Subject w/att 


SECOM/[___]fh (1/11/80) 
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Resources continue to be tight while 
technological opportunity grows. Under these 
conditions wise investment can proceed only if the 
goals we are trying to achieve are understood and 
there is agreement on relative priorities. 


Presented are a set of interlocking goals for 
Information Handling. Goals are understood to be 
ideals toward which we strive. There is no 
guarantee that goals are achievable, but there is 
the sense that the future will be better if we 
work collectively toward common ends, even when 
those ends are not completely achieved. Conflicts 
between some of the goals are recognized. 


Information Handling Goals: 


1. Increase the productivity and efficiency of our people and 
: components; 


a Improve the quality of the Agency's products; 


3. Improve the timeliness of decisions and the responsiveness of 
" our products; 


cx Improve the security of our activities; 


chs Extend the sense of Headquarters community to all Agency 


components in all locations ——ssS—<CSsSS™T 25X1- 


- 6. Make information handling tools a natural, well-integrated 
part of the office work pattern; : 


7. Eliminate information handling activities of marginal value 


vis-a-vis their cost; 


“8. Reduce the life-cycle costs of existing and plenned 
information systems; 
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Ensure, in the face of competing demands, that information 
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10. 


15. 


16. 


17. 


18. 


Improve the accessibility of data bases and their quality with 
regard to consistency and completeness; 


Shorten the coordination, approval, and release cycle of both 
intelligence and administrative actions; 


Provide better control over access to classified information 7 
including provision of individual accountability; 


Provide more secure. storage for sensitive material; ‘ 


Icprove maintainability of information handling systems, both 
existing and planned. The means must be found to stabilize the 
cost of keeping production systems working effectively. 


Shorten information system development time. Information 
systems must take into account a rapidly changing technology 
in meeting evolving needs. We cannot tolerate a 7-12 year 
development cycle with the attendant risks of having unwanted 
or outmoded systems when they go into operation. 


Maintain a cadre of information handling professionals with 
the requisite skills to meet the needs over the next decade. 
Our focus must be on finding and keeping people who can reduce 
the life-cycle information systems costs through goals 14 and 


-415. 


Establish system management standards. We rust codify our 
collective experience in developing and operating systems into 
an agreed upon and enforced set of management procedures.- 
This is vital to the attainment of goals 14, 15, and 16 above. 


Communicate most information electrically between people, 
wherever they may be. This includes Headquarters~field 
communication, sending products to consumers, etc. This goal 
is central to the achievement of several others: achieving a 
sense of community (5), integrating information tools into 
office work patterns (6), improving data base accessibility 
(10), and shortening the coordination cycle (11). “The 


movement of. dpformation. by.m aps OF paper is slow,’ 
inefficieat, and preseats un qué sécurity risks. (Still, paper 
has singular, virtues. as a medium For the reader, so electrical 
distribution implies the availability of conveniently 
positioned printing and facsimile devices. 
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20. 


21. 


23. 


; 24. 
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dea sin - universal networ user téwwinals. 
information user should have one and only one terminal at 
his/her desk. 


Provide the means to capture keystrokes. Frequently, 

information is retyped, rekeyed, or "repoked" to make minor 
changes or to convert it to another format for distribution, 
reproduction, or filing. We must eliminate this tedious and 
error-prone activity. 


Achiéve a Consistent’ and natural Ageucy-wide standard for 
access to information services. Access mechanisms should be 

tailored to the needs of the person, not to the peculiarities 
of the system. Consistency is needed to reduce training time 
and achieve other information handling goals (18, 19, and 20). 


Store information more efficiently. Improved data base 
quality and access depend on inexpensive, fast file 
organization techniques. Both the technology and theory show 
that multiply-accessed, single~copy file storage can improve 
accuracy, consistency, and economy. 


‘Aperegate information for managers and analysts. Most 


information systems are built for specialist users, with 
products tailored to needs which are known beforehand. ; 
Analysts and managers often do not, or cannot predict their 
information needs. In the absence of this apriori knowledge, 
they must resort to looking at much raw data. Better means 
must be found to meet theix information needs with the 
available data by processing stored data into higher-level 
forms on an ad hoc basis. 

% fons 
Provide multilevel security access te data bases. Physical 
data compartmentation should be employed only where 
sensitivity and cost warrant. Considerable technological 
progress has been made toward achieving secure access to 
multilevel security files by users cleared at different 
levels. We must accelerate this effort. Multilevel security 
capabilities are essential to achieving better access control 
for those systems that are not single-level and compartmented. 


Develop Cryptographic devices for user terminals and storage 
devices. The microelectronics revolution permits compact, 
inexpensive cryptographic devices that can be used not only 
for end-to-end secure electrical transmission (essential for 
goal 18), but also for additional information storage security 
(goal 13). 
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26. Develop effe ‘ive top-level coordination ain + managers of 
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if we are to proceed in step on several of the goals listed 
here: establishing management standards (17), maintaining a 
professional cadre (16), providing a universal terminal net 
(19), developing a sense of community (5), and developing a 
standard, natural means for user access to information 
services (21). 


27. Develop effective top-level coordination among managers of 
componenets that use information services. Continuing : 
managemant attention from an Agency perspective is needed to 

_-ferret out marginal activities (7) and to sort ont priorities 
(10). Without a mechanism to make hard decisions on 
resources, we will not have the means to achieve the basic 
goals for improving performance, 


28. Establish the means to accelerate the integration of 
communications and centralized information services, 
“particularly ADP services. ; . 


{28+ Agency systems should be developed with consideration for 
~~ “community compatibility. As reguirements for inter-Agency 
connections arise, future systems should be capable of 
efficient and cost-effective interconnection. 


30. Develop overall investment and resource guidance for Agency 
information handling. This is needed for two reasons. 
Pursuit of some of the developmental goals involves large up- 
front costs. For example, the general goal to reduce life- 
cycle system costs (8) in some cases may require volume 
equipment buys or initial investments in backbone 
communication facilities with capacities that far exceed 
initial needs. Secondly, many of the listed information 
handling goals are in conflict because of their resource 
implications: improving security vs: improving access to. 
informations reducing life-cycle system costs vs. improved 
quality and timeliness of our product. Priority attention 
must be given to resource guidance early in the planning 
period, but the means must be found to adjust it continually 
as conditions change. Resource decisions will require changes 
to action programs directed to these goals; indeed, they may 
produce major adjustments in the goals themselves. 
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